Practical Cybersecurity with Jen Stone

Wish PCI DSS would just stop changing? Jeremy King spent 15 years as PCI's European vice president, and he explains why it can't. Recorded during PCI's 20th anniversary at PCI North America Community Meeting in Vancouver, SecurityMetrics QSA Jen Stone talks with Jeremy about how PCI standards actually get written, why criminals shift tactics as payment security improves, and why tre...

PCI DSS 4.0.1 has been the standard for a while now, but a lot of organizations are still stuck on the same handful of requirements. In this episode, Jen Stone sits down with Matt Halbleib, Director of Assessments at SecurityMetrics, to break down where SMBs keep getting tripped up — and how to fix it.  Key topics covered: Why you need to read the actual standard (not just the summary of changes)...

You can pass your PCI assessment and still be leaking cardholder data. In e-commerce, compliant and secure are not the same thing — and AI just made the gap between them a lot harder to ignore. In this episode, SecurityMetrics Principal Security Analyst Jen Stone is joined by forensic investigator Aaron Willis and [HOST NAME] for a practitioner panel on how AI is reshaping attacks on cardholder da...

How much of your business actually needs to be PCI compliant? Almost always less than you think. Every system inside your PCI scope is something you have to secure, document, and prove — year after year. So the fastest way to cut the cost and effort of compliance isn't working harder on controls. It's making your scope smaller. In this episode, Principal Security Analysts Jen Stone and M...

About 100 authorized assessors. An estimated 118,000+ companies that need to be assessed. That math is the reason CMMC can't wait — and it's where this conversation starts. Brett Cox, lead CMMC Certified Assessor and head of Boeing's DFARS CMMC Program Management Office, joins host Jen Stone to explain what the Cybersecurity Maturity Model Certification actually requires, why the No...

First time filling out a PCI SAQ? In this episode, two QSAs who've scoped hundreds of payment environments walk you through how to pick the right one—so you don't end up with the wrong form, the wrong security controls, and the wrong amount of risk. Choosing the right PCI DSS Self-Assessment Questionnaire (SAQ) isn't just a paperwork decision. Pick the wrong form and you can leave b...

Passwords were built for a different era of the internet. It’s time to move past shared secrets to close your organization's largest threat vector for good. Traditional passwords and legacy Multi-Factor Authentication (MFA) are no longer enough to protect your business. Automated, scaling phishing toolkits easily intercept shared secrets, leaving small and medium businesses highly vulnerable...

We can't keep turning a blind eye to e-commerce skimming. It's a real threat that demands real attention—regardless of how compliance checklists evolve. Eighteen months ago, our panel met to break down the rollout of PCI DSS requirements 6.4.3 and 11.6.1. Now, one year after PCI v4.0, we're looking at the data-backed reality of how these requirements are actually playing out in the...

Is your organization prepared for an autonomous AI bot? Roger Grimes joins Jen Stone to discuss the shifting landscape of cybersecurity. This episode moves past the hype to look at the hard data: AI scams are yielding 4.5x more value for attackers, and traditional MFA is no longer enough to stop them. In this episode, we translate complex "vulnerability fatigue" into a clear, two-step pr...

This episode of Practical Cybersecurity moves past the standard PCI checklist to focus on the operational realities, common misconceptions, and "stealth" requirements that define SAQ A in the PCI DSS v4.0.1 era.  The Eligibility Foundation Most merchants skip the Eligibility Criteria , which is the actual foundation of the assessment. Total Data Outsourcing: To qualify, a merchant must n...

Episode Summary In this episode of Practical Cybersecurity , we dive into the complex world of HITRUST certification. Often called the "gold standard" for healthcare security, HITRUST can be a daunting mountain to climb for small and large organizations alike. Jen Stone and experts Peter Briel (Privaxi) and Lee Pierce (SecurityMetrics) break down why scoping is your best friend, why scre...

A single data breach now costs a business an average of $1.4 million, according to the annual IBM report. For a small or medium-sized business (SMB), this hit is often terminal—most companies that suffer a major breach struggle to stay in business longer than six months. In this episode, Matt "Heff" Heffelfinger , Director of SOC Operations at SecurityMetrics, joins us to discuss why man...

Are your IT or cloud providers handling your security? Does your site claim you're "HIPAA Compliant"? Donna Grindle, CEO of Kardon and co-host of Help Me With HIPAA , delivers a massive reality check for small business owners. We break down the difference between gap analysis and a true SRA, why IT speaks a different language, and how the "CREMATE" method finds your data....

What happens when the news cameras show up and your business grinds to a halt? Donna Grindle, CEO of Kardon, returns to discuss the "hair on fire" reality of a data breach. We move past the paperwork to explore why "calling IT" isn't a plan, the hidden costs of notification letters, and how insurance mazes can complicate your recovery. Key Takeaways "Call IT" is...

"I can’t think about cybersecurity this week; I’m thinking about 1099s." You’re not alone. Many SMBs see the NIST Cybersecurity Framework (CSF) as an overwhelming manual for government contractors, not a local shop or startup.  Jen Stone sits down with Daniel Eliot , NIST’s lead for small business engagement. We break down the new NIST CSF 2.0 Small Business Quick Start Guide —a "sm...

In this episode of Practical Cybersecurity , host Jen Stone talks with Curt Dukes, EVP and GM of Security Best Practices at the Center for Internet Security (CIS). Drawing on his 30-year career at the NSA, Dukes breaks down how small and medium businesses (SMBs) can implement "good enough" security without unlimited resources. The conversation focuses on Implementation Group 1 (IG1) —a p...

In this webinar, Matt Halbleib (Director of Assessments) and Lee Pierce (Director of HITRUST Sales) will discuss: How to determine which HITRUST Assessment type to choose How to prepare for a HITRUST Validation Assessment What to expect from a SecurityMetrics HITRUST Assessment Ready to discuss your HITRUST needs? Request a quote here. Read our new HITRUST 101 White Paper here. A note from Jen: We...

Learn more about cyber risks for small businesses:  Are you a small-medium business owner? Did you just get a message from your bank telling you to call SecurityMetrics? Are you worried about having a bad experience? Do you know what PCI even means? This episode is for you. Learn how SecurityMetrics can help you navigate this regulatory landscape. We'll discuss: Why your processor is making y...

Join us on this extra long episode as SecurityMetrics experts Jen Stone, Gary Glover, Aaron Willis and Chad Horton dive deep into the evolving landscape of PCI compliance for e-commerce businesses. With the deadline for PCI 4.0 rapidly approaching, understanding the new requirements for e-commerce is crucial. In this episode, our panelists discuss: Understanding PCI 4.0 for e-commerce: Learn about...

Download the guide: https://www.cisecurity.org/insights/white-papers/from-both-sides-a-parental-guide-to-protecting-your-childs-online-activity Are you a parent looking for guidance on how to keep kids safe online? Join us for a candid conversation with Sean Atkinson, CISO at the Center for Internet Security, and his daughter, Emma, as they discuss their journey of creating a guide designed to hel...

Links from the episode: https://405d.hhs.gov/ Discover the latest trends and threats in healthcare cybersecurity. This episode explores the real-world impact of cyberattacks on patient care, the vulnerabilities of medical devices, and the strategies organizations can implement to protect their sensitive data. A note from Jen: We built Practical Cybersecurity because we were tired of the fear-monge...

Confused about PCI DSS compliance standards? This video breaks down each available SAQ type, including: SAQ-A, SAQ P2PE-HW, SAQ D for Service Providers, and the newly introduced SAQ SPoC for PCI DSS 4.0. Learn which one is right for your business based on your payment processing environment. Learn about: Different SAQ types for merchants Eligibility criteria for each SAQ type Factors to consider w...

Join Jen Stone as she chats with DevOps engineer and Day Two DevOps podcaster Kyler Middleton about her unique journey from a rural upbringing to becoming a DevOps expert. Discover how Kyler's passion for teaching led her to a career in technology, and learn about the importance of automation and documentation in building secure and efficient cloud environments. This episode dives deep into D...

Is your penetration testing just a compliance formality? This episode of the SecurityMetrics Podcast redefines pen testing as a strategic partnership, empowering you to get the most out of your assessments. Join Jen Stone and James Farnsworth as they discuss: The critical role of scoping: Learn how to align business needs with technical assessments for a truly impactful pen test. The difference be...

This episode of the SecurityMetrics Podcast is a valuable resource for MSPs who want to learn more about HIPAA compliance and how to better serve their healthcare clients. Join Jen Stone and David Sims to learn more about how Managed Service Providers (MSPs) can empower healthcare organizations to achieve HIPAA compliance. Learn about: The challenges of data discovery and data sprawl in healthcare...